linux-kernel - Re: [f2fs-dev] [PATCH] f2fs: remove race condition in releasing cblocks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cd08c824-c5d3-9603-7a81-a48cb191ac99@huawei.com>
Date:   Fri, 8 May 2020 15:09:06 +0800
From:   Chao Yu <yuchao0@...wei.com>
To:     Daeho Jeong <daeho43@...il.com>
CC:     <linux-kernel@...r.kernel.org>,
        <linux-f2fs-devel@...ts.sourceforge.net>,
        <kernel-team@...roid.com>, Daeho Jeong <daehojeong@...gle.com>
Subject: Re: [f2fs-dev] [PATCH] f2fs: remove race condition in releasing
 cblocks

On 2020/5/8 14:58, Daeho Jeong wrote:
> I moved checking i_compr_blocks phrase after calling inode_lock()
> already, because we should check this after writing pages.
> 
> So, if it fails to check i_compr_blocks, we need to call inode_unlock().
> 
> Am I missing something?

After applying this patch, I get this:

	ret = mnt_want_write_file(filp);
	if (ret)
		return ret;

	if (!F2FS_I(inode)->i_compr_blocks)
		goto out;

	f2fs_balance_fs(F2FS_I_SB(inode), true);

	inode_lock(inode);

> 
> 2020년 5월 8일 (금) 오후 3:50, Chao Yu <yuchao0@...wei.com>님이 작성:
>>
>> On 2020/5/8 12:25, Daeho Jeong wrote:
>>> From: Daeho Jeong <daehojeong@...gle.com>
>>>
>>> Now, if writing pages and releasing compress blocks occur
>>> simultaneously, and releasing cblocks is executed more than one time
>>> to a file, then total block count of filesystem and block count of the
>>> file could be incorrect and damaged.
>>>
>>> We have to execute releasing compress blocks only one time for a file
>>> without being interfered by writepages path.
>>>
>>> Signed-off-by: Daeho Jeong <daehojeong@...gle.com>
>>> ---
>>>  fs/f2fs/file.c | 31 ++++++++++++++++++++++++-------
>>>  1 file changed, 24 insertions(+), 7 deletions(-)
>>>
>>> diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
>>> index 4aab4b42d8ba..a92bc51b9b28 100644
>>> --- a/fs/f2fs/file.c
>>> +++ b/fs/f2fs/file.c
>>> @@ -3488,6 +3488,7 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)
>>>       pgoff_t page_idx = 0, last_idx;
>>>       unsigned int released_blocks = 0;
>>>       int ret;
>>> +     int writecount;
>>>
>>>       if (!f2fs_sb_has_compression(F2FS_I_SB(inode)))
>>>               return -EOPNOTSUPP;
>>
>> Before inode_lock(), there is one case we may jump to out label, in
>> this case, we may unlock inode incorrectly.
>>
>>         if (!F2FS_I(inode)->i_compr_blocks)
>>                 goto out;
>>
>>> -
>>> -     inode_unlock(inode);
>>>  out:
>>> +     inode_unlock(inode);
>>> +
>>>       mnt_drop_write_file(filp);
>>
>> Thanks,
> .
>